Stored XSS in Three WordPress Chat Plugins
WP Live Chat Support, MyLiveChat and Provide Support all accepted stored cross-site scripting during a 2014 customer install.
Coordinated disclosure
Vendor first, publish after the fix ships. It costs time and it is still the right way to do it.
2014
Path Traversal on map.prezi.com ($1,000)
A path traversal issue on Prezi's map.prezi.com subdomain, fixed within two days of reporting and rewarded with a $1,000 bounty.
2013
160 German tax office sites vulnerable to XSS
Reflected cross-site scripting across 160 German tax office websites, disclosed via heise.de and forwarded to CERT-Bund for coordinated remediation.